Study Hub / ISC2 Certified in Cybersecurity (CC) / Domain 1.0
ISC2 Certified in Cybersecurity (CC) Domain 1.0: Security Principles — Explained
Domain 1.0 is what security is for: the CIA triad that defines every security goal, the risk equation that justifies every control, and the control types that make up the toolkit. The rest of the CC exam is commentary on this domain.
The CIA triad: the three goals
- Confidentiality — information is accessible only to authorized parties. Encryption, access controls, classification. Breach signal: data seen by the wrong eyes.
- Integrity — information is accurate and unaltered. Hashing, checksums, digital signatures, version control. Breach signal: data changed without authorization.
- Availability — information and systems are reachable when needed. Redundancy, backups, DDoS protection. Breach signal: legitimate users locked out.
Beyond the triad, the CC expects three companion concepts:
- Authenticity — the data genuinely comes from who it claims (digital signatures prove this).
- Non-repudiation — the sender can't later deny sending it (again, signatures — with trusted timestamps).
- Privacy — individuals' control over their personal information; distinct from confidentiality, which is organizational.
Risk: threat × vulnerability × impact
- Threat — anything that could cause harm: hackers, malware, floods, human error. Threats exist whether or not you're vulnerable.
- Vulnerability — a weakness a threat could exploit: unpatched software, weak passwords, an unlocked door.
- Risk — the combination: a threat exploiting a vulnerability to cause impact. No threat or no vulnerability → no risk from that pair.
- Risk management cycle — identify, assess (likelihood × impact), treat (mitigate / transfer / accept / avoid), monitor. It never ends because threats and systems keep changing.
- Total risk vs. residual risk — total risk is the untreated exposure; residual risk is what remains after controls. Residual risk is never zero — management accepts it formally.
Security controls: the toolkit
- By category — technical (firewalls, encryption — enforced by systems), administrative (policies, training — enforced by rules), physical (locks, guards — enforced by the real world).
- By function — preventive (stop it: firewall deny), detective (find it: IDS alert), corrective (fix it: restore from backup), deterrent (discourage it: warning signs), compensating (substitute when the primary control can't apply).
- Defense in depth — layered controls so one failure isn't fatal: a firewall and patched systems and trained users and backups.
- Least privilege & separation of duties — give each person only the access their job needs; split critical tasks so no one person can complete fraud alone. Two people, two halves of the safe combination.
Policies, standards, procedures, guidelines
Governance documents form a hierarchy — know the distinctions:
- Policy — senior-management statement of what must be done and why. Mandatory, high-level, rarely changes. ("All portable devices must use encryption.")
- Standard — the specific how: mandatory technical details implementing the policy. ("AES-256 via BitLocker on Windows laptops.")
- Procedure — step-by-step instructions for a task. ("How to provision a new hire's laptop, screens 1–12.")
- Guideline — recommended, not mandatory. ("Consider a password manager for personal accounts.")
- Baseline — the minimum mandatory security bar for a class of systems. Everything gets at least this.
Governance roles and risk decisions
- Senior management / board — owns security governance: sets direction, funds it, accepts residual risk. Security without executive backing is decoration.
- Data owner — the business executive accountable for a dataset. Decides who may access it and how it's classified.
- Data custodian — implements the owner's decisions day to day (backups, access provisioning). Often IT.
- Risk treatment, again — mitigate (add controls), transfer (insurance), accept (document and proceed), avoid (stop the activity). The CC frames these as business decisions with security input — cost vs. risk reduction.
- Risk assessment inputs — asset value, threat likelihood, vulnerability severity, and impact. Qualitative (scales) for speed; quantitative (dollars) for budgets.
The must-memorize table: control functions
Name the function by what the control is trying to do.
| Function | Goal | Example |
|---|---|---|
| Preventive | Stop the incident | Firewall deny rule, door lock |
| Deterrent | Discourage the attempt | "Monitored by CCTV" sign |
| Detective | Discover it happening/happened | IDS alert, log review |
| Corrective | Repair the damage | Restore from backup, reimage host |
| Compensating | Substitute control when primary is impossible | Extra monitoring on an unpatchable system |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. An attacker alters prices in an online store's database. Customers are charged wrong amounts, but no data was stolen and the site stayed up. Which security goal was violated?
- A. A. Confidentiality
- B. B. Integrity
- C. C. Availability
- D. D. Non-repudiation
Show answer & reasoning
B. The data was altered without authorization — the textbook integrity violation. Nothing was exposed (not confidentiality) and the site worked fine (not availability). Non-repudiation (D) is about proving who did something, which isn't the issue here.
2. A company has no firewall and an unpatched web server, but operates on an isolated network with no external connectivity and no malicious insiders. What best describes its risk from internet attackers?
- A. A. High — the vulnerabilities are severe
- B. B. Low — with no threat able to reach the vulnerabilities, that risk pairing doesn't exist
- C. C. Zero — air gaps eliminate all risk
- D. D. Unchanged — risk ignores threats
Show answer & reasoning
B. Risk needs both threat and vulnerability. Severe vulnerabilities (A) with no reachable threat produce little risk from that threat. But "zero" (C) overreaches — insider threats, USB drops, and supply-chain issues remain. Risk is always threat × vulnerability × impact.
3. A bank requires two employees to jointly authorize any wire transfer over $10,000. Which principle is this?
- A. A. Least privilege
- B. B. Defense in depth
- C. C. Separation of duties
- D. D. Fail securely
Show answer & reasoning
C. Splitting a critical action so no single person can complete it alone is separation of duties — the classic fraud control. Least privilege (A) is about how much access each person has, not about splitting one action between two people.
4. A hospital can't patch an MRI workstation (the vendor forbids it), so it isolates the machine on its own VLAN with extra monitoring. What kind of control is the isolation?
- A. A. Preventive — the primary control
- B. B. Deterrent — it discourages attackers
- C. C. Compensating — a substitute where the primary control can't be applied
- D. D. Corrective — it fixes the vulnerability
Show answer & reasoning
C. Patching (the primary control) is impossible, so isolation + monitoring compensates — it doesn't fix the vulnerability (not corrective), it substitutes protection around it. Compensating controls are the exam's answer whenever "we can't do the normal thing, so we do this instead."
This was one domain. The simulator drills all 5.
This free preview covered Security Principles (Domain 1.0, 26%). Not covered here: Access Controls Concepts (Domain 3.0, 22%); Network Security (Domain 4.0, 24%). The two most technical domains — access control models and network security — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full ISC2 CC Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy